nox-openclaw-hunter 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (211) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +140 -0
  3. package/bin/nox.js +2 -0
  4. package/dist/branding.d.ts +39 -0
  5. package/dist/branding.d.ts.map +1 -0
  6. package/dist/branding.js +66 -0
  7. package/dist/branding.js.map +1 -0
  8. package/dist/cli.d.ts +15 -0
  9. package/dist/cli.d.ts.map +1 -0
  10. package/dist/cli.js +94 -0
  11. package/dist/cli.js.map +1 -0
  12. package/dist/commands/export.d.ts +21 -0
  13. package/dist/commands/export.d.ts.map +1 -0
  14. package/dist/commands/export.js +616 -0
  15. package/dist/commands/export.js.map +1 -0
  16. package/dist/commands/index.d.ts +8 -0
  17. package/dist/commands/index.d.ts.map +1 -0
  18. package/dist/commands/index.js +8 -0
  19. package/dist/commands/index.js.map +1 -0
  20. package/dist/commands/isolate.d.ts +30 -0
  21. package/dist/commands/isolate.d.ts.map +1 -0
  22. package/dist/commands/isolate.js +547 -0
  23. package/dist/commands/isolate.js.map +1 -0
  24. package/dist/commands/purge.d.ts +22 -0
  25. package/dist/commands/purge.d.ts.map +1 -0
  26. package/dist/commands/purge.js +295 -0
  27. package/dist/commands/purge.js.map +1 -0
  28. package/dist/commands/scan.d.ts +23 -0
  29. package/dist/commands/scan.d.ts.map +1 -0
  30. package/dist/commands/scan.js +155 -0
  31. package/dist/commands/scan.js.map +1 -0
  32. package/dist/detector/app-bundle.d.ts +13 -0
  33. package/dist/detector/app-bundle.d.ts.map +1 -0
  34. package/dist/detector/app-bundle.js +27 -0
  35. package/dist/detector/app-bundle.js.map +1 -0
  36. package/dist/detector/cli-binary.d.ts +12 -0
  37. package/dist/detector/cli-binary.d.ts.map +1 -0
  38. package/dist/detector/cli-binary.js +66 -0
  39. package/dist/detector/cli-binary.js.map +1 -0
  40. package/dist/detector/config.d.ts +21 -0
  41. package/dist/detector/config.d.ts.map +1 -0
  42. package/dist/detector/config.js +337 -0
  43. package/dist/detector/config.js.map +1 -0
  44. package/dist/detector/detection-config.d.ts +24 -0
  45. package/dist/detector/detection-config.d.ts.map +1 -0
  46. package/dist/detector/detection-config.js +242 -0
  47. package/dist/detector/detection-config.js.map +1 -0
  48. package/dist/detector/docker.d.ts +10 -0
  49. package/dist/detector/docker.d.ts.map +1 -0
  50. package/dist/detector/docker.js +94 -0
  51. package/dist/detector/docker.js.map +1 -0
  52. package/dist/detector/index.d.ts +50 -0
  53. package/dist/detector/index.d.ts.map +1 -0
  54. package/dist/detector/index.js +155 -0
  55. package/dist/detector/index.js.map +1 -0
  56. package/dist/detector/network.d.ts +34 -0
  57. package/dist/detector/network.d.ts.map +1 -0
  58. package/dist/detector/network.js +205 -0
  59. package/dist/detector/network.js.map +1 -0
  60. package/dist/detector/process.d.ts +16 -0
  61. package/dist/detector/process.d.ts.map +1 -0
  62. package/dist/detector/process.js +47 -0
  63. package/dist/detector/process.js.map +1 -0
  64. package/dist/detector/service.d.ts +17 -0
  65. package/dist/detector/service.d.ts.map +1 -0
  66. package/dist/detector/service.js +51 -0
  67. package/dist/detector/service.js.map +1 -0
  68. package/dist/enforcer/docker-cleaner.d.ts +30 -0
  69. package/dist/enforcer/docker-cleaner.d.ts.map +1 -0
  70. package/dist/enforcer/docker-cleaner.js +163 -0
  71. package/dist/enforcer/docker-cleaner.js.map +1 -0
  72. package/dist/enforcer/file-remover.d.ts +34 -0
  73. package/dist/enforcer/file-remover.d.ts.map +1 -0
  74. package/dist/enforcer/file-remover.js +137 -0
  75. package/dist/enforcer/file-remover.js.map +1 -0
  76. package/dist/enforcer/index.d.ts +33 -0
  77. package/dist/enforcer/index.d.ts.map +1 -0
  78. package/dist/enforcer/index.js +142 -0
  79. package/dist/enforcer/index.js.map +1 -0
  80. package/dist/enforcer/process-killer.d.ts +18 -0
  81. package/dist/enforcer/process-killer.d.ts.map +1 -0
  82. package/dist/enforcer/process-killer.js +80 -0
  83. package/dist/enforcer/process-killer.js.map +1 -0
  84. package/dist/enforcer/service-stopper.d.ts +23 -0
  85. package/dist/enforcer/service-stopper.d.ts.map +1 -0
  86. package/dist/enforcer/service-stopper.js +95 -0
  87. package/dist/enforcer/service-stopper.js.map +1 -0
  88. package/dist/index.d.ts +6 -0
  89. package/dist/index.d.ts.map +1 -0
  90. package/dist/index.js +10 -0
  91. package/dist/index.js.map +1 -0
  92. package/dist/isolator/firewall.d.ts +25 -0
  93. package/dist/isolator/firewall.d.ts.map +1 -0
  94. package/dist/isolator/firewall.js +114 -0
  95. package/dist/isolator/firewall.js.map +1 -0
  96. package/dist/isolator/index.d.ts +63 -0
  97. package/dist/isolator/index.d.ts.map +1 -0
  98. package/dist/isolator/index.js +201 -0
  99. package/dist/isolator/index.js.map +1 -0
  100. package/dist/isolator/lockdown.d.ts +22 -0
  101. package/dist/isolator/lockdown.d.ts.map +1 -0
  102. package/dist/isolator/lockdown.js +401 -0
  103. package/dist/isolator/lockdown.js.map +1 -0
  104. package/dist/isolator/quarantine.d.ts +39 -0
  105. package/dist/isolator/quarantine.d.ts.map +1 -0
  106. package/dist/isolator/quarantine.js +364 -0
  107. package/dist/isolator/quarantine.js.map +1 -0
  108. package/dist/mdm/index.d.ts +93 -0
  109. package/dist/mdm/index.d.ts.map +1 -0
  110. package/dist/mdm/index.js +414 -0
  111. package/dist/mdm/index.js.map +1 -0
  112. package/dist/mdm/intune.d.ts +69 -0
  113. package/dist/mdm/intune.d.ts.map +1 -0
  114. package/dist/mdm/intune.js +409 -0
  115. package/dist/mdm/intune.js.map +1 -0
  116. package/dist/mdm/jamf.d.ts +58 -0
  117. package/dist/mdm/jamf.d.ts.map +1 -0
  118. package/dist/mdm/jamf.js +441 -0
  119. package/dist/mdm/jamf.js.map +1 -0
  120. package/dist/mdm/jumpcloud.d.ts +73 -0
  121. package/dist/mdm/jumpcloud.d.ts.map +1 -0
  122. package/dist/mdm/jumpcloud.js +470 -0
  123. package/dist/mdm/jumpcloud.js.map +1 -0
  124. package/dist/mdm/templates/detect.ps1.d.ts +30 -0
  125. package/dist/mdm/templates/detect.ps1.d.ts.map +1 -0
  126. package/dist/mdm/templates/detect.ps1.js +463 -0
  127. package/dist/mdm/templates/detect.ps1.js.map +1 -0
  128. package/dist/mdm/templates/detect.sh.d.ts +30 -0
  129. package/dist/mdm/templates/detect.sh.d.ts.map +1 -0
  130. package/dist/mdm/templates/detect.sh.js +474 -0
  131. package/dist/mdm/templates/detect.sh.js.map +1 -0
  132. package/dist/mdm/templates/enforce.ps1.d.ts +33 -0
  133. package/dist/mdm/templates/enforce.ps1.d.ts.map +1 -0
  134. package/dist/mdm/templates/enforce.ps1.js +681 -0
  135. package/dist/mdm/templates/enforce.ps1.js.map +1 -0
  136. package/dist/mdm/templates/enforce.sh.d.ts +33 -0
  137. package/dist/mdm/templates/enforce.sh.d.ts.map +1 -0
  138. package/dist/mdm/templates/enforce.sh.js +591 -0
  139. package/dist/mdm/templates/enforce.sh.js.map +1 -0
  140. package/dist/platform/darwin.d.ts +6 -0
  141. package/dist/platform/darwin.d.ts.map +1 -0
  142. package/dist/platform/darwin.js +192 -0
  143. package/dist/platform/darwin.js.map +1 -0
  144. package/dist/platform/index.d.ts +43 -0
  145. package/dist/platform/index.d.ts.map +1 -0
  146. package/dist/platform/index.js +27 -0
  147. package/dist/platform/index.js.map +1 -0
  148. package/dist/platform/linux.d.ts +6 -0
  149. package/dist/platform/linux.d.ts.map +1 -0
  150. package/dist/platform/linux.js +134 -0
  151. package/dist/platform/linux.js.map +1 -0
  152. package/dist/platform/windows.d.ts +6 -0
  153. package/dist/platform/windows.d.ts.map +1 -0
  154. package/dist/platform/windows.js +134 -0
  155. package/dist/platform/windows.js.map +1 -0
  156. package/dist/reporter/console.d.ts +27 -0
  157. package/dist/reporter/console.d.ts.map +1 -0
  158. package/dist/reporter/console.js +431 -0
  159. package/dist/reporter/console.js.map +1 -0
  160. package/dist/reporter/index.d.ts +11 -0
  161. package/dist/reporter/index.d.ts.map +1 -0
  162. package/dist/reporter/index.js +13 -0
  163. package/dist/reporter/index.js.map +1 -0
  164. package/dist/reporter/json.d.ts +61 -0
  165. package/dist/reporter/json.d.ts.map +1 -0
  166. package/dist/reporter/json.js +75 -0
  167. package/dist/reporter/json.js.map +1 -0
  168. package/dist/reporter/webhook.d.ts +57 -0
  169. package/dist/reporter/webhook.d.ts.map +1 -0
  170. package/dist/reporter/webhook.js +230 -0
  171. package/dist/reporter/webhook.js.map +1 -0
  172. package/dist/types/config.d.ts +116 -0
  173. package/dist/types/config.d.ts.map +1 -0
  174. package/dist/types/config.js +6 -0
  175. package/dist/types/config.js.map +1 -0
  176. package/dist/types/detection.d.ts +85 -0
  177. package/dist/types/detection.d.ts.map +1 -0
  178. package/dist/types/detection.js +5 -0
  179. package/dist/types/detection.js.map +1 -0
  180. package/dist/types/enforcement.d.ts +33 -0
  181. package/dist/types/enforcement.d.ts.map +1 -0
  182. package/dist/types/enforcement.js +5 -0
  183. package/dist/types/enforcement.js.map +1 -0
  184. package/dist/types/index.d.ts +8 -0
  185. package/dist/types/index.d.ts.map +1 -0
  186. package/dist/types/index.js +8 -0
  187. package/dist/types/index.js.map +1 -0
  188. package/dist/types/isolation.d.ts +55 -0
  189. package/dist/types/isolation.d.ts.map +1 -0
  190. package/dist/types/isolation.js +5 -0
  191. package/dist/types/isolation.js.map +1 -0
  192. package/dist/utils/exec.d.ts +48 -0
  193. package/dist/utils/exec.d.ts.map +1 -0
  194. package/dist/utils/exec.js +103 -0
  195. package/dist/utils/exec.js.map +1 -0
  196. package/dist/utils/fs.d.ts +34 -0
  197. package/dist/utils/fs.d.ts.map +1 -0
  198. package/dist/utils/fs.js +111 -0
  199. package/dist/utils/fs.js.map +1 -0
  200. package/dist/utils/index.d.ts +7 -0
  201. package/dist/utils/index.d.ts.map +1 -0
  202. package/dist/utils/index.js +7 -0
  203. package/dist/utils/index.js.map +1 -0
  204. package/dist/utils/logger.d.ts +14 -0
  205. package/dist/utils/logger.d.ts.map +1 -0
  206. package/dist/utils/logger.js +48 -0
  207. package/dist/utils/logger.js.map +1 -0
  208. package/docs/intune.md +390 -0
  209. package/docs/jamf.md +400 -0
  210. package/docs/jumpcloud.md +510 -0
  211. package/package.json +65 -0
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Nox Security
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md ADDED
@@ -0,0 +1,140 @@
1
+ ```
2
+ ███╗ ██╗ ██████╗ ██╗ ██╗
3
+ ████╗ ██║██╔═══██╗╚██╗██╔╝
4
+ ██╔██╗ ██║██║ ██║ ╚███╔╝
5
+ ██║╚██╗██║██║ ██║ ██╔██╗
6
+ ██║ ╚████║╚██████╔╝██╔╝ ██╗
7
+ ╚═╝ ╚═══╝ ╚═════╝ ╚═╝ ╚═╝
8
+ ```
9
+
10
+ # OpenClaw Hunter
11
+
12
+ **Hunt, purge, and isolate OpenClaw AI agents across your fleet.**
13
+
14
+ ---
15
+
16
+ ## Installation
17
+
18
+ ```bash
19
+ npm install -g nox-openclaw-hunter
20
+ ```
21
+
22
+ Or from source:
23
+
24
+ ```bash
25
+ git clone https://github.com/Arampc/Nox-OpenClaw-Hunter.git
26
+ cd Nox-OpenClaw-Hunter
27
+ npm install && npm run build && npm link
28
+ ```
29
+
30
+ > Requires Node.js 18+
31
+
32
+ ---
33
+
34
+ ## Commands
35
+
36
+ ### `nox scan`
37
+
38
+ Hunt for OpenClaw installations on the system.
39
+
40
+ ```bash
41
+ nox scan # Scan current user
42
+ nox scan --all-users # Scan all users (requires sudo)
43
+ nox scan --json # Output as JSON
44
+ nox scan --yaml # Output as YAML
45
+ ```
46
+
47
+ ### `nox purge`
48
+
49
+ Purge all OpenClaw components from the system.
50
+
51
+ ```bash
52
+ nox purge --dry-run # Preview what will be purged
53
+ sudo nox purge # Execute purge
54
+ sudo nox purge --force # Skip confirmation
55
+ ```
56
+
57
+ ### `nox isolate`
58
+
59
+ Isolate the device by blocking ports, quarantining files, and preventing reinstallation.
60
+
61
+ ```bash
62
+ nox isolate --dry-run # Preview isolation actions
63
+ sudo nox isolate # Apply isolation
64
+ sudo nox isolate revert # Revert isolation
65
+ nox isolate list # List quarantined items
66
+ ```
67
+
68
+ ### `nox export`
69
+
70
+ Generate MDM deployment scripts for fleet-wide hunting.
71
+
72
+ ```bash
73
+ nox export --platform jamf --mode detect
74
+ nox export --platform intune --mode purge
75
+ nox export --platform jumpcloud --mode detect --webhook https://siem.example.com
76
+ ```
77
+
78
+ **Supported platforms:** `jamf`, `intune`, `jumpcloud`
79
+
80
+ ---
81
+
82
+ ## What It Detects
83
+
84
+ | Component | Detection Method |
85
+ |-----------|------------------|
86
+ | CLI Binary | Known paths, `which` lookup |
87
+ | App Bundle | `/Applications/OpenClaw.app` (macOS) |
88
+ | Config | `~/.openclaw`, `~/.clawdbot`, `~/.moltbot` |
89
+ | Gateway | TCP port scan (auto-detects port) |
90
+ | Processes | Process name matching |
91
+ | Service | `launchctl` / `systemctl` / `sc` |
92
+ | Docker | Containers and images |
93
+
94
+ ---
95
+
96
+ ## Webhook Integration
97
+
98
+ Send results to your SIEM or alerting system:
99
+
100
+ ```bash
101
+ nox scan --webhook https://siem.example.com --webhook-token SECRET
102
+ nox purge --webhook https://siem.example.com --webhook-token SECRET
103
+ nox isolate --webhook https://siem.example.com --webhook-token SECRET
104
+ ```
105
+
106
+ ---
107
+
108
+ ## Exit Codes
109
+
110
+ | Code | Status | Description |
111
+ |------|--------|-------------|
112
+ | 0 | `CLEAN` | Not detected |
113
+ | 1 | `DETECTED` | OpenClaw found |
114
+ | 2 | `ERROR` | Runtime error |
115
+ | 3 | `REMEDIATED` | Purge successful |
116
+ | 4 | `PURGE_FAILED` | Purge failed |
117
+ | 5 | `ISOLATED` | Isolation applied |
118
+
119
+ ---
120
+
121
+ ## Platform Support
122
+
123
+ - **macOS** — Full support (CLI, app bundle, launchd services)
124
+ - **Linux** — Full support (CLI, systemd services)
125
+ - **Windows** — Full support (CLI, Windows services)
126
+
127
+ ---
128
+
129
+ ## License
130
+
131
+ MIT
132
+
133
+ ---
134
+
135
+ **Support:** arampeleschen@gmail.com, ilai.goldschmidt@gmail.com
136
+ **Issues:** [github.com/Arampc/Nox-OpenClaw-Hunter/issues](https://github.com/Arampc/Nox-OpenClaw-Hunter/issues)
137
+
138
+ ---
139
+
140
+ **Nox Security™**
package/bin/nox.js ADDED
@@ -0,0 +1,2 @@
1
+ #!/usr/bin/env node
2
+ import '../dist/index.js';
@@ -0,0 +1,39 @@
1
+ /**
2
+ * Nox Security branding constants and utilities.
3
+ */
4
+ export declare const VERSION: string;
5
+ export declare const TOOL_NAME = "nox-openclaw-hunter";
6
+ export declare const DISPLAY_NAME = "Nox OpenClaw Hunter";
7
+ export declare const COMPANY = "Nox Security";
8
+ /**
9
+ * ASCII art banner for the CLI.
10
+ */
11
+ export declare const BANNER_ART: string;
12
+ /**
13
+ * Print the Nox banner to console.
14
+ * @param showVersion - Whether to show the version line
15
+ */
16
+ export declare function printBanner(showVersion?: boolean): void;
17
+ /**
18
+ * Exit codes for CLI.
19
+ */
20
+ export declare const EXIT_CODES: {
21
+ /** OpenClaw not installed */
22
+ readonly CLEAN: 0;
23
+ /** OpenClaw detected */
24
+ readonly DETECTED: 1;
25
+ /** Script/runtime error */
26
+ readonly ERROR: 2;
27
+ /** Enforcement successful */
28
+ readonly REMEDIATED: 3;
29
+ /** Enforcement failed */
30
+ readonly ENFORCE_FAILED: 4;
31
+ /** Isolation applied */
32
+ readonly ISOLATED: 5;
33
+ };
34
+ export type ExitCode = typeof EXIT_CODES[keyof typeof EXIT_CODES];
35
+ /**
36
+ * Get exit code name for display.
37
+ */
38
+ export declare function getExitCodeName(code: ExitCode): string;
39
+ //# sourceMappingURL=branding.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"branding.d.ts","sourceRoot":"","sources":["../src/branding.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,eAAO,MAAM,OAAO,QAAc,CAAC;AAEnC,eAAO,MAAM,SAAS,wBAAwB,CAAC;AAC/C,eAAO,MAAM,YAAY,wBAAwB,CAAC;AAClD,eAAO,MAAM,OAAO,iBAAiB,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,UAAU,QAOtB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,WAAW,UAAO,GAAG,IAAI,CAOpD;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;IACrB,6BAA6B;;IAE7B,wBAAwB;;IAExB,2BAA2B;;IAE3B,6BAA6B;;IAE7B,yBAAyB;;IAEzB,wBAAwB;;CAEhB,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,OAAO,UAAU,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAElE;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAUtD"}
@@ -0,0 +1,66 @@
1
+ /**
2
+ * Nox Security branding constants and utilities.
3
+ */
4
+ import chalk from 'chalk';
5
+ import { createRequire } from 'node:module';
6
+ const require = createRequire(import.meta.url);
7
+ const pkg = require('../package.json');
8
+ export const VERSION = pkg.version;
9
+ export const TOOL_NAME = 'nox-openclaw-hunter';
10
+ export const DISPLAY_NAME = 'Nox OpenClaw Hunter';
11
+ export const COMPANY = 'Nox Security';
12
+ /**
13
+ * ASCII art banner for the CLI.
14
+ */
15
+ export const BANNER_ART = `
16
+ ${chalk.cyan('███╗ ██╗ ██████╗ ██╗ ██╗')}
17
+ ${chalk.cyan('████╗ ██║██╔═══██╗╚██╗██╔╝')}
18
+ ${chalk.cyan('██╔██╗ ██║██║ ██║ ╚███╔╝ ')}
19
+ ${chalk.cyan('██║╚██╗██║██║ ██║ ██╔██╗ ')}
20
+ ${chalk.cyan('██║ ╚████║╚██████╔╝██╔╝ ██╗')}
21
+ ${chalk.cyan('╚═╝ ╚═══╝ ╚═════╝ ╚═╝ ╚═╝')}
22
+ `;
23
+ /**
24
+ * Print the Nox banner to console.
25
+ * @param showVersion - Whether to show the version line
26
+ */
27
+ export function printBanner(showVersion = true) {
28
+ console.log(BANNER_ART);
29
+ if (showVersion) {
30
+ console.log(chalk.bold(`OpenClaw Hunter v${VERSION}`));
31
+ console.log(chalk.dim(COMPANY));
32
+ console.log();
33
+ }
34
+ }
35
+ /**
36
+ * Exit codes for CLI.
37
+ */
38
+ export const EXIT_CODES = {
39
+ /** OpenClaw not installed */
40
+ CLEAN: 0,
41
+ /** OpenClaw detected */
42
+ DETECTED: 1,
43
+ /** Script/runtime error */
44
+ ERROR: 2,
45
+ /** Enforcement successful */
46
+ REMEDIATED: 3,
47
+ /** Enforcement failed */
48
+ ENFORCE_FAILED: 4,
49
+ /** Isolation applied */
50
+ ISOLATED: 5,
51
+ };
52
+ /**
53
+ * Get exit code name for display.
54
+ */
55
+ export function getExitCodeName(code) {
56
+ const names = {
57
+ [EXIT_CODES.CLEAN]: 'CLEAN',
58
+ [EXIT_CODES.DETECTED]: 'DETECTED',
59
+ [EXIT_CODES.ERROR]: 'ERROR',
60
+ [EXIT_CODES.REMEDIATED]: 'REMEDIATED',
61
+ [EXIT_CODES.ENFORCE_FAILED]: 'ENFORCE_FAILED',
62
+ [EXIT_CODES.ISOLATED]: 'ISOLATED',
63
+ };
64
+ return names[code] ?? 'UNKNOWN';
65
+ }
66
+ //# sourceMappingURL=branding.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"branding.js","sourceRoot":"","sources":["../src/branding.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE9D,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;AAEnC,MAAM,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAClD,MAAM,CAAC,MAAM,OAAO,GAAG,cAAc,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;EACxB,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;EACzC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;EACzC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;EACzC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;EACzC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;EACzC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;CAC1C,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,WAAW,GAAG,IAAI;IAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,6BAA6B;IAC7B,KAAK,EAAE,CAAC;IACR,wBAAwB;IACxB,QAAQ,EAAE,CAAC;IACX,2BAA2B;IAC3B,KAAK,EAAE,CAAC;IACR,6BAA6B;IAC7B,UAAU,EAAE,CAAC;IACb,yBAAyB;IACzB,cAAc,EAAE,CAAC;IACjB,wBAAwB;IACxB,QAAQ,EAAE,CAAC;CACH,CAAC;AAIX;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,KAAK,GAA6B;QACtC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO;QAC3B,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU;QACjC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO;QAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,YAAY;QACrC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,gBAAgB;QAC7C,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU;KAClC,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AAClC,CAAC"}
package/dist/cli.d.ts ADDED
@@ -0,0 +1,15 @@
1
+ /**
2
+ * CLI entry point using Commander.js
3
+ *
4
+ * Registers all commands for the Nox OpenClaw Detector CLI.
5
+ */
6
+ import { Command } from 'commander';
7
+ /**
8
+ * Create and configure the CLI program.
9
+ */
10
+ export declare function createProgram(): Command;
11
+ /**
12
+ * Run the CLI.
13
+ */
14
+ export declare function run(): Promise<void>;
15
+ //# sourceMappingURL=cli.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC;;GAEG;AACH,wBAAgB,aAAa,IAAI,OAAO,CA+EvC;AAED;;GAEG;AACH,wBAAsB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAGzC"}
package/dist/cli.js ADDED
@@ -0,0 +1,94 @@
1
+ /**
2
+ * CLI entry point using Commander.js
3
+ *
4
+ * Registers all commands for the Nox OpenClaw Detector CLI.
5
+ */
6
+ import { Command } from 'commander';
7
+ import { VERSION, DISPLAY_NAME, COMPANY } from './branding.js';
8
+ import { scanCommand } from './commands/scan.js';
9
+ import { purgeCommand } from './commands/purge.js';
10
+ import { isolateApplyCommand, isolateRevertCommand, isolateListCommand, } from './commands/isolate.js';
11
+ import { exportCommand } from './commands/export.js';
12
+ /**
13
+ * Create and configure the CLI program.
14
+ */
15
+ export function createProgram() {
16
+ const program = new Command();
17
+ program
18
+ .name('nox')
19
+ .description(`${DISPLAY_NAME} - Hunt, purge, and isolate OpenClaw by ${COMPANY}`)
20
+ .version(VERSION, '-v, --version', 'Output the current version')
21
+ .option('--debug', 'Enable debug logging');
22
+ // Scan command
23
+ program
24
+ .command('scan')
25
+ .description('Scan for OpenClaw installations')
26
+ .option('--all-users', 'Scan all user directories (requires sudo)')
27
+ .option('--port <port>', 'Gateway port to check (default: auto-detect)', parseInt)
28
+ .option('--json', 'Output JSON format')
29
+ .option('--yaml', 'Output YAML format')
30
+ .option('--webhook <url>', 'Send results to webhook URL')
31
+ .option('--webhook-token <token>', 'Bearer token for webhook authentication')
32
+ .option('-q, --quiet', 'Suppress banner and informational output')
33
+ .action(scanCommand);
34
+ // Purge command
35
+ program
36
+ .command('purge')
37
+ .description('Detect and remove OpenClaw (requires sudo, use --dry-run to preview)')
38
+ .option('--dry-run', 'Preview actions without executing')
39
+ .option('-f, --force', 'Skip confirmation prompts')
40
+ .option('--json', 'Output JSON format')
41
+ .option('--webhook <url>', 'Send results to webhook URL')
42
+ .option('--webhook-token <token>', 'Bearer token for webhook authentication')
43
+ .option('-q, --quiet', 'Suppress banner and informational output')
44
+ .action(purgeCommand);
45
+ // Isolate command with subcommands
46
+ const isolateCmd = program
47
+ .command('isolate')
48
+ .description('Isolate device from OpenClaw (requires sudo, use --dry-run to preview)')
49
+ .option('--port <port>', 'Specify port to block (default: auto-detect from scan)', parseInt)
50
+ .option('--dry-run', 'Preview actions without executing')
51
+ .option('--webhook <url>', 'Send isolation alert to webhook')
52
+ .option('--webhook-token <token>', 'Bearer token for webhook authentication')
53
+ .option('--json', 'Output JSON format')
54
+ .option('-f, --force', 'Skip confirmation prompts')
55
+ .option('-q, --quiet', 'Suppress banner and informational output')
56
+ .action(isolateApplyCommand);
57
+ // isolate revert
58
+ isolateCmd
59
+ .command('revert')
60
+ .description('Revert all isolation actions')
61
+ .option('--port <port>', 'Specify port to unblock (default: auto-detect)', parseInt)
62
+ .option('--dry-run', 'Preview actions without executing')
63
+ .option('--json', 'Output JSON format')
64
+ .option('-f, --force', 'Skip confirmation prompts')
65
+ .option('-q, --quiet', 'Suppress banner and informational output')
66
+ .action(isolateRevertCommand);
67
+ // isolate list
68
+ isolateCmd
69
+ .command('list')
70
+ .alias('ls')
71
+ .description('List quarantined items')
72
+ .option('--json', 'Output JSON format')
73
+ .option('-q, --quiet', 'Suppress banner')
74
+ .action(isolateListCommand);
75
+ // Export command
76
+ program
77
+ .command('export')
78
+ .description('Export MDM deployment scripts')
79
+ .requiredOption('--platform <platform>', 'MDM platform (jamf|intune|jumpcloud)')
80
+ .option('--mode <mode>', 'Script mode (detect|purge)', 'detect')
81
+ .option('--output <dir>', 'Output directory', './scripts')
82
+ .option('--webhook <url>', 'Include webhook URL in scripts')
83
+ .option('--webhook-token <token>', 'Include webhook token in scripts')
84
+ .action(exportCommand);
85
+ return program;
86
+ }
87
+ /**
88
+ * Run the CLI.
89
+ */
90
+ export async function run() {
91
+ const program = createProgram();
92
+ await program.parseAsync(process.argv);
93
+ }
94
+ //# sourceMappingURL=cli.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,KAAK,CAAC;SACX,WAAW,CAAC,GAAG,YAAY,2CAA2C,OAAO,EAAE,CAAC;SAChF,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,4BAA4B,CAAC;SAC/D,MAAM,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAE7C,eAAe;IACf,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,aAAa,EAAE,2CAA2C,CAAC;SAClE,MAAM,CAAC,eAAe,EAAE,8CAA8C,EAAE,QAAQ,CAAC;SACjF,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;SACxD,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,CAAC;SAC5E,MAAM,CAAC,aAAa,EAAE,0CAA0C,CAAC;SACjE,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,gBAAgB;IAChB,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,sEAAsE,CAAC;SACnF,MAAM,CAAC,WAAW,EAAE,mCAAmC,CAAC;SACxD,MAAM,CAAC,aAAa,EAAE,2BAA2B,CAAC;SAClD,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;SACxD,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,CAAC;SAC5E,MAAM,CAAC,aAAa,EAAE,0CAA0C,CAAC;SACjE,MAAM,CAAC,YAAY,CAAC,CAAC;IAExB,mCAAmC;IACnC,MAAM,UAAU,GAAG,OAAO;SACvB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,eAAe,EAAE,wDAAwD,EAAE,QAAQ,CAAC;SAC3F,MAAM,CAAC,WAAW,EAAE,mCAAmC,CAAC;SACxD,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;SAC5D,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,CAAC;SAC5E,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,aAAa,EAAE,2BAA2B,CAAC;SAClD,MAAM,CAAC,aAAa,EAAE,0CAA0C,CAAC;SACjE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE/B,iBAAiB;IACjB,UAAU;SACP,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,MAAM,CAAC,eAAe,EAAE,gDAAgD,EAAE,QAAQ,CAAC;SACnF,MAAM,CAAC,WAAW,EAAE,mCAAmC,CAAC;SACxD,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,aAAa,EAAE,2BAA2B,CAAC;SAClD,MAAM,CAAC,aAAa,EAAE,0CAA0C,CAAC;SACjE,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAEhC,eAAe;IACf,UAAU;SACP,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC;SACxC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAE9B,iBAAiB;IACjB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,cAAc,CAAC,uBAAuB,EAAE,sCAAsC,CAAC;SAC/E,MAAM,CAAC,eAAe,EAAE,4BAA4B,EAAE,QAAQ,CAAC;SAC/D,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,WAAW,CAAC;SACzD,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,CAAC;SAC3D,MAAM,CAAC,yBAAyB,EAAE,kCAAkC,CAAC;SACrE,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC"}
@@ -0,0 +1,21 @@
1
+ /**
2
+ * Export command - generate MDM deployment scripts.
3
+ */
4
+ interface ExportCommandOptions {
5
+ platform: string;
6
+ mode: string;
7
+ output: string;
8
+ webhook?: string;
9
+ webhookToken?: string;
10
+ parent?: {
11
+ opts(): {
12
+ debug?: boolean;
13
+ };
14
+ };
15
+ }
16
+ /**
17
+ * Export command handler.
18
+ */
19
+ export declare function exportCommand(options: ExportCommandOptions): Promise<void>;
20
+ export {};
21
+ //# sourceMappingURL=export.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../src/commands/export.ts"],"names":[],"mappings":"AAAA;;GAEG;AAaH,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE;QACP,IAAI,IAAI;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC7B,CAAC;CACH;AAgjBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmFhF"}